{"id":"MAL-2026-16240","kind":"package","aliases":["MAL-2026-16240"],"related":[],"title":"Malicious code in praetorian-mind-rce-test-2026 (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1)\nAt `pip install` time, setup.py calls a phone_home() routine at module top-level before setup() runs. The routine collects extensive host and container reconnaissance — hostname, uid/gid, uname, /etc/resolv.conf, /etc/hosts, /proc/self/cgroup, mount output, ps aux, directory listings of /, /app, /home — and serializes the complete process environment via `{k: v for k, v in sorted(os.environ.items())}`. When ECS_CONTAINER_METADATA_URI_V4 is present, it additionally fetches ECS container and task metadata (which exposes IAM task-role context useful for credential abuse). The aggregated JSON payload is POSTed via urllib.request.urlopen to the hardcoded non-publisher endpoint https://5h6gijnewx787zu6.ixx.sh. The full-environment dump routinely contains CI, cloud, and registry credentials (AWS_*, tokens, secrets), and the ECS metadata read enables IAM role abuse against the installer's cloud account.\n\n## Source: kam193 (f9a677a1b1a8762a3f01e91a8da196298bf146b255dc7f9d834842916882372b)\nDuring installation, package exfiltrates environment variables, tokens from cloud environments and fingerprints the environment. It identifies itself as a security testing engagement.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-praetorian-mind-rce-test-2026\n\n\nReasons (based on the campaign):\n\n\n - exfiltration-env-variables\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - exfiltration-cloud-tokens\n\n## Source: ossf-package-analysis (48d3d63e8f3773e745ea3c4961c8d598e880db130cf063cc738a381080c2b782)\nThe OpenSSF Package Analysis project identified 'praetorian-mind-rce-test-2026' @ 0.0.2 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"praetorian-mind-rce-test-2026","fixed":[],"affected":"= 0.0.1; = 0.0.2; = 0.0.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-16T17:30:57+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':205C '-16240':13A,16A '-2026':12A,15A '/app':78C '/etc/hosts':69C '/etc/resolv.conf':68C '/home':79C '/proc/self/cgroup':70C '0.0.2':263C '2026':9A,22A,204C,211C,262C '48d3d63e8f3773e745ea3c4961c8d598e880db130cf063cc738a381080c2b782':250C '5h6gijnewx787zu6.ixx.sh':137C 'a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1':38C 'abus':121C,161C 'account':167C 'addit':104C 'aggreg':123C 'amazon':36C 'amazon-inspector':35C 'analysi':249C,254C 'associ':279C 'aux':74C 'aw':150C 'base':213C 'basic':227C 'behavior':282C 'call':44C 'campaign':196C,203C,216C 'categori':193C 'ci':145C 'clear':198C 'cloud':146C,166C,179C,243C 'code':2A,224C 'collect':59C 'command':278C 'complet':83C 'consid':269C 'contain':63C,97C,107C,144C,223C 'context':117C 'credenti':120C,149C 'data':228C 'detail':27C 'directori':75C 'dump':142C 'ec':96C,106C,155C 'edit':30C 'enabl':158C 'endpoint':136C 'engag':192C 'env':219C 'environ':85C,141C,175C,180C,184C 'execut':274C 'exfiltr':174C,218C,226C,242C 'exfiltration-cloud-token':241C 'exfiltration-env-vari':217C 'expos':112C 'extens':60C 'f9a677a1b1a8762a3f01e91a8da196298bf146b255dc7f9d834842916882372b':170C 'fetch':105C 'fingerprint':182C 'full':140C 'full-environ':139C 'hardcod':132C 'home':47C 'host':61C 'hostnam':65C 'iam':113C,159C 'identifi':186C,256C 'infosteal':202C 'inspector':37C 'instal':41C,164C,172C 'intent':200C 'ip':233C 'json':124C 'k':87C,90C 'kam193':169C 'level':53C 'like':201C,232C 'limit':239C 'line':33C 'list':76C 'mal':11A,14A 'malici':1A,23B,194C,199C,266C,270C,281C 'metadata':98C,110C,156C 'mind':6A,19A,208C,259C 'modul':50C 'mount':71C 'non':134C 'non-publish':133C 'one':275C 'openssf':252C 'os.environ.items':94C 'ossf':247C 'ossf-package-analysi':246C 'output':72C 'packag':24B,173C,222C,248C,253C,273C 'payload':125C 'per':25C 'phone':46C 'pip':40C 'post':127C 'praetorian':5A,18A,207C,258C 'praetorian-mind-rce-test':4A,17A,206C,257C 'present':102C 'process':84C 'project':255C 'ps':73C 'publish':135C 'pypi':10A,264C 'rce':7A,20A,209C,260C 'read':157C 'reason':212C 'reconnaiss':64C 'registri':148C 'risk':240C 'role':116C,160C 'routin':48C,58C,143C 'run':56C 'secret':152C 'secur':190C 'serial':81C 'setup':55C 'setup.py':43C 'sort':93C 'sourc':26C,34C,168C,245C 'system':231C 'task':109C,115C 'task-rol':114C 'test':8A,21A,191C,210C,261C 'time':42C 'token':151C,177C,244C 'top':52C 'top-level':51C 'uid/gid':66C 'unam':67C 'uri':99C 'urllib.request.urlopen':129C 'use':118C 'usernam':235C 'v':88C,91C 'v4':100C 'variabl':176C,220C 'via':86C,128C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-16T17:30:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16240","url":"https://osv.dev/vulnerability/MAL-2026-16240","severity":"critical","published_at":"2026-09-16T17:30:57+00:00","modified_at":"2026-09-17T14:30:05+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}